openclaw/docs
openclaw/docs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(sync): mirror docs from openclaw/openclaw@a9d77b3eb0

Browse Source
This commit is contained in:
openclaw-docs-sync[bot] 2026-05-04 05:52:51 +00:00
parent 1ef64ecc6c
commit a66708a4d7
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.openclaw-sync/source.json
View File

@ -1,5 +1,5 @@
{
"repository": "openclaw/openclaw",
"sha": "bc0b54e8448512c5bec26aa7ddff774373884d4b",
"syncedAt": "2026-05-04T05:48:04.564Z"
"sha": "a9d77b3eb09d5e59d551921632775b70dec2c0ba",
"syncedAt": "2026-05-04T05:50:54.867Z"
}

10
docs/web/control-ui.md
View File

@ -384,6 +384,16 @@ When gateway auth is configured, the Control UI avatar endpoint requires the sam
If you disable gateway auth (not recommended on shared hosts), the avatar route also becomes unauthenticated, in line with the rest of the gateway.
## Assistant media route auth
When gateway auth is configured, assistant local-media previews use a two-step route:
- `GET /__openclaw__/assistant-media?meta=1&source=<path>` requires the normal Control UI operator auth. The browser sends the gateway token as a bearer header when checking availability.
- Successful metadata responses include a short-lived `mediaTicket` scoped to that exact source path.
- Browser-rendered image, audio, video, and document URLs use `mediaTicket=<ticket>` instead of the active gateway token or password. The ticket expires quickly and cannot authorize a different source.
This keeps normal media rendering compatible with browser-native media elements without putting reusable gateway credentials in visible media URLs.
## Building the UI
The Gateway serves static files from `dist/control-ui`. Build them with: